Homebrew 6.0.0 Release: Overhauled Third‑Party Tap Trust, Linux Sandbox, and Faster JSON API

Homebrew 6.0.0 is a milestone release that focuses on four major areas: security hardening, low‑level architecture refactoring, runtime performance, and practical new features.

Explicit third‑party Tap trust

Previously, adding a Tap with brew tap automatically parsed all formulas in the repository, which could silently consume resources and enable supply‑chain attacks if the Tap was malicious. The new "Tap explicit trust" mechanism marks newly added Taps as untrusted; they are only parsed after the user runs a trust command such as brew tap --trust user/repo. This separation of "add" and "trust" drastically reduces the risk of inadvertent code execution.

JSON API replaces YAML for bottle metadata

Homebrew migrates its bottle metadata storage from YAML to a native JSON API, eliminating the old YAML parsing path. Users see faster refresh of package information, and third‑party Tap maintainers must now provide JSON‑formatted bottle files, which improves CI/CD compatibility and long‑term ecosystem standardisation.

Linux sandbox aligned with macOS security

The release integrates Bubblewrap, a lightweight namespace sandbox, to enforce minimal‑privilege execution on Linux, matching macOS’s security model. Applications installed via Homebrew run in isolated environments, limiting read/write access to critical system directories and mitigating lateral movement even if a package contains vulnerabilities.

Practical new features

brew exec : a lightweight runner modelled after Node’s npx, allowing direct execution of installed tools without modifying the global PATH.

brew bundle parallel install : Brewfile installations now download and install packages concurrently, dramatically shortening environment provisioning time for teams.

Native integration of npm and krew plugins, and early compatibility work for macOS 27, so future OS updates require no additional Homebrew patches.

Three critical security vulnerabilities fixed

The update patches an HTTPS redirect bypass, a Git‑hooks privilege‑escalation flaw, and a previously undisclosed third‑party supply‑chain issue, providing the security backdrop for the new trust mechanism.

Performance optimisations

brew leaves

runs about 30 % faster, making orphan‑dependency checks quicker.

Refined Ruby library loading reduces overall Homebrew cold‑start latency.

Deprecation warnings for legacy environment variables and a roadmap to reduce Intel macOS support after September 2026.

Upgrade and usage commands

# Upgrade to the latest stable version
brew update
brew upgrade
brew cleanup

# Trust a third‑party Tap
brew tap --trust user/repo

# List trust status (JSON)
brew trust --json=v1

# Run a tool without polluting PATH
brew exec tool-name args

# Export current environment (including trusted taps)
brew bundle dump

# Parallel install from Brewfile
brew bundle install

# Common diagnostics
brew leaves
brew doctor
brew config

Overall, Homebrew 6.0.0 delivers a security‑first foundation, a modernised JSON‑driven architecture, and performance‑focused enhancements that benefit both individual developers and server‑side operations.